Dave Mason - Helping Real People use Real Computers in the Real World!

Data Recovery Situations

Physical and Logical Data Recovery

We need to distinguish between two completely different processes. Extracting the raw data from the affected media is the physical data recovery, and reconstructing the files and structure is the logical data recovery.

You can suffer purely logical data loss. File deletion, drive formatting or virus attacks only require logical reconstruction. On the other hand, a drive that has failed mechanically and is successfully repaired may need no logical reconstruction.

In the real world many physical problems require logical reconstruction because data has been corrupted by the failure itself, or user data recovery attempts.

More than 90% of data loss incidents are logical file system corruptions and not physical drive failure. We specialize in Logical Data Recovery.

Physical recovery is not always possible

Success depends on the extent of the damage to a drive. It is not possible to recover data from a disk that was heated up to "Curie temperature" (which is 770 C for iron). This temperature completely demagnetizes the platters. This temperature is not uncommon in large structure fires.

It is doubtful data will recovered from a drive that fell from a significant height onto a hard surface. If the platters are unbalanced due to bending on impact they will vibrate while spinning. If the vertical motion of this vibration is larger than the distance the read head flies, the drive will experience a permanent head crash making reading the magnetic information impossible and further destroying the surface. Horizontal vibration will make it impossible for the head to stay in alignment on the track, with data recovery next to impossible.

Success also depends on the drive type. Modern drives are conditioned after their assembly to work perfectly with the parts built in, heads, platters etc. Tolerances are so tight it is often impossible to use parts of another drive even if both drives share the same model number.

There is no "magic" capable of recovering the data from all kinds of drives. If the raw data can be retrieved, a logical reconstruction of the files must then be performed.

Data Recovery After Formatting

Formatting a disk clears both file allocation tables and deletes the root directory. All data is still there, but you have lost the entries in the root directory. Files can only be recovered as "lost files". Sub-directories of the first level (root) will have numbers for a name instead of their original name. Lower level sub directories will retain their original name. You have also lost the file allocation tables. This will cause a fragmentation problem that compromises data recovery.

In this situation you will get a fair data recovery. Most of your files should be uncorrupted. You will need to look for your files in the numbered directories. Any fragmented files, such as Outlook email files or databases, will be corrupted and probably unusable.

In NTFS, formatting a volume creates a new MFT. However, this affects only the first 25 or so entries. It usually does not touch the MFT entries of previous user files.

The means you can expect a better data recovery. Almost all files should be fully resurrected.

Your results will be even better when you formatted a drive that was previously FAT-formatted with NTFS or vice versa. In this case the original FAT or MFT will probably not be damaged because these structures are located at different areas on the drive.

Data Recovery After Deleting/Recreating a Partition

When you delete a partition, only the partition table and the boot record are affected. Important structures, such as MFT and FAT are usually undamaged.

Believe it or not even recreating the partition should not alter important data structures as long as you don't format the volume

In these cases, Dr Dave can usually get an almost perfect data recovery.

Dead Hard Drive

A drive can be considered "dead", if it is not accessible by any software means, for example, the BIOS, Windows' Disk Management or disk utilities such as Norton or Ontrack. A dead drive often shows additional symptoms. Sometimes it won't spin or it "clicks", "whines" or makes other strange noises.

Theses drives might have a damaged electronic board, damaged read heads, a damaged motor or damaged magnetic media. Data recovery companies with clean room facilities can often resurrect the drive by exchanging the damaged parts. They will then image the drive and perform a logical file reconstruction.

This is often successful and practical when the data is absolutely critical and then well worth the cost of thousands of Dollars. However, sometimes it is not successful. Drives With "Bad Sectors"

These drives are still recognized by the BIOS or software such as Disk Manager but they have read errors in one or more spots.

It should be noted that you should not try to do a data recovery yourself if the drive makes unusual noises. The process of attempting data recovery can further damage the media. Instead send to Dr Dave right away so an image can be created and recovery efforts applied to the image and not on the drive itself.

It is difficult to predict how long it will actually take to recover the data. This depends primarily on drive capacity and the number of bad sectors on the drive and can take from 30 minutes up to several days.

Data Recovery After Installing a New Windows Operating System

Installing a new operating system can overwrite at least 1 GB. All the files that were once located on this area of the drive are irretrievably lost. The directories entries (FAT) and MFT entries (NTFS) located there will be lost, leaving only files without reference ("lost file"), that had been allocated in undamaged areas beyond the 1 GB area.

In FAT this will also destroy the FATs, thus causing the fragmentation problem. All you possibly can recover will come from the not overwritten area.

Data Recovery After Imaging or "Ghosting" a Drive

The consequences of imaging over a drive, for example with Norton's Ghost, are similar to the ones you face after putting a new OS on it. If the image is large, chances that you will recover a lot of files are pretty slim.

Data Recovery After Deleting Files

Although seemingly easy, this is tougher than recovering files from a bad sector drive or after an Fdisk or format.

File deletion is the least understood topic.

Ironically, what makes data recovery of deleted files so hard is the fact that the user can still work with his drive. The users attempts to recover the just deleted files often ruin your chances.

The locations of the deleted files are not protected by the file system anymore. Those locations might be recycled the next time the OS creates a new file. That's why it is such a problem if the user continues to work with the affected hard drive.

Files are created all the time. Background processes write log files. Even booting and running Windows once from the drive we need to recover data from can overwrite critical areas. Browsing a single Website downloads multiple files to the hard drive potentially ruining the possibility of recovering data from those areas. To protect those deleted files you must stop working with the drive immediately.

We've tested how long a deleted file was recoverable before the OS recycled the deleted file's directory entry, MFT or allocation. It happens almost instantly. This leads us to be very pessimistic about the prospects of recovering "a couple" of deleted files.

Whereas, if you deleted - let's say 1 GB consisting of 1000 files - and do not continue to work with this drive, chances to recover most of these files are pretty good. If you work with FAT, you will possibly face the fragmentation problem.

[TOP]